Hacker News Reader

Comment by Afforess | Hacker News Reader

What "attack surface"? Almost all your ports, no applications listen to. Closing them serves no useful purpose.

If an application has problems accepting input on a port it is listening to, that is an application bug. Closing your ports doesn't solve this, it just hides the problem under the rug, and breaks the Internet in the process.

View on HN

> Closing your ports doesn't solve this, it just hides the problem under the rug, and breaks the Internet in the process.

To be fair, if you don't listen to tin-foil-hatters like GRC and configure your firewalls to REJECT non-invalid [0] traffic, rather than DROP, the only thing you'll break is the ability for others outside your network to connect to services on those ports.

[0] In the iptables CONNTRACK sense of "invalid".

The firewalls you mentioned were NAT/Enterprise level. They do not generally have absolute control of what programs are running on one of their internal computers. May be that port left open is used by a C&C client installed on one of the user's computer inside LAN, hereby possibly compromising the whole internal network. There is a reason why DMZs exist.

Corporate security is a different sort of beast from almost every other security environment. What's acceptable in that arena is almost always an unacceptable management practice for someone who is designing and operating what is supposed to be a network of peers.

Reply on news.ycombinator.com